@carlonicora/nestjs-neo4jsonapi 1.113.0 → 1.115.0

package/dist/foundations/module/queries/feature.module.query.d.ts

@@ -1,4 +1,4 @@
 export declare const modulePermissionResolutionQuery = "\n    WITH m,\n        coalesce(apoc.convert.fromJsonList(m.permissions), []) AS defaultPermissions,\n        collect(perm) AS perms\n    WITH m, defaultPermissions,\n        apoc.coll.flatten([p IN perms | coalesce(apoc.convert.fromJsonList(p.permissions), [])]) AS rolePerms\n    WITH m,\n        head([x IN defaultPermissions WHERE x.type = 'create' | x.value]) AS defaultCreate,\n        head([x IN defaultPermissions WHERE x.type = 'read'   | x.value]) AS defaultRead,\n        head([x IN defaultPermissions WHERE x.type = 'update' | x.value]) AS defaultUpdate,\n        head([x IN defaultPermissions WHERE x.type = 'delete' | x.value]) AS defaultDelete,\n        rolePerms\n    WITH m,\n        [defaultCreate] + [x IN rolePerms WHERE x.type = 'create' | x.value] AS createValues,\n        [defaultRead]   + [x IN rolePerms WHERE x.type = 'read'   | x.value] AS readValues,\n        [defaultUpdate] + [x IN rolePerms WHERE x.type = 'update' | x.value] AS updateValues,\n        [defaultDelete] + [x IN rolePerms WHERE x.type = 'delete' | x.value] AS deleteValues\n    WITH m,\n        CASE\n        WHEN any(x IN createValues WHERE x = true) THEN true\n        WHEN any(x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(createValues), false)\n        END AS effectiveCreate,\n        CASE\n        WHEN any(x IN readValues WHERE x = true) THEN true\n        WHEN any(x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(readValues), false)\n        END AS effectiveRead,\n        CASE\n        WHEN any(x IN updateValues WHERE x = true) THEN true\n        WHEN any(x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(updateValues), false)\n        END AS effectiveUpdate,\n        CASE\n        WHEN any(x IN deleteValues WHERE x = true) THEN true\n        WHEN any(x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(deleteValues), false)\n        END AS effectiveDelete\n    WITH m, apoc.convert.toJson([\n            { type: \"create\", value: effectiveCreate },\n            { type: \"read\",   value: effectiveRead },\n            { type: \"update\", value: effectiveUpdate },\n            { type: \"delete\", value: effectiveDelete }\n        ]) AS newPermissions\n    CALL apoc.create.vNode(\n    labels(m),\n    apoc.map.merge(properties(m), { permissions: newPermissions })\n    ) YIELD node AS module\n\n    RETURN module\n";
-export declare const featureModuleQuery = "\n    OPTIONAL MATCH (user)-[:MEMBER_OF]->(role:Role)\n    OPTIONAL MATCH (feature:Feature)\n      WHERE exists((company)-[:HAS_FEATURE]->(feature))\n         OR feature.isCore = true\n    MATCH (m:Module)-[:IN_FEATURE]->(feature)\n    OPTIONAL MATCH (role)-[perm:HAS_PERMISSIONS]->(m)\n    \n    WITH m,\n        coalesce(apoc.convert.fromJsonList(m.permissions), []) AS defaultPermissions,\n        collect(perm) AS perms\n    WITH m, defaultPermissions,\n        apoc.coll.flatten([p IN perms | coalesce(apoc.convert.fromJsonList(p.permissions), [])]) AS rolePerms\n    WITH m,\n        head([x IN defaultPermissions WHERE x.type = 'create' | x.value]) AS defaultCreate,\n        head([x IN defaultPermissions WHERE x.type = 'read'   | x.value]) AS defaultRead,\n        head([x IN defaultPermissions WHERE x.type = 'update' | x.value]) AS defaultUpdate,\n        head([x IN defaultPermissions WHERE x.type = 'delete' | x.value]) AS defaultDelete,\n        rolePerms\n    WITH m,\n        [defaultCreate] + [x IN rolePerms WHERE x.type = 'create' | x.value] AS createValues,\n        [defaultRead]   + [x IN rolePerms WHERE x.type = 'read'   | x.value] AS readValues,\n        [defaultUpdate] + [x IN rolePerms WHERE x.type = 'update' | x.value] AS updateValues,\n        [defaultDelete] + [x IN rolePerms WHERE x.type = 'delete' | x.value] AS deleteValues\n    WITH m,\n        CASE\n        WHEN any(x IN createValues WHERE x = true) THEN true\n        WHEN any(x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(createValues), false)\n        END AS effectiveCreate,\n        CASE\n        WHEN any(x IN readValues WHERE x = true) THEN true\n        WHEN any(x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(readValues), false)\n        END AS effectiveRead,\n        CASE\n        WHEN any(x IN updateValues WHERE x = true) THEN true\n        WHEN any(x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(updateValues), false)\n        END AS effectiveUpdate,\n        CASE\n        WHEN any(x IN deleteValues WHERE x = true) THEN true\n        WHEN any(x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(deleteValues), false)\n        END AS effectiveDelete\n    WITH m, apoc.convert.toJson([\n            { type: \"create\", value: effectiveCreate },\n            { type: \"read\",   value: effectiveRead },\n            { type: \"update\", value: effectiveUpdate },\n            { type: \"delete\", value: effectiveDelete }\n        ]) AS newPermissions\n    CALL apoc.create.vNode(\n    labels(m),\n    apoc.map.merge(properties(m), { permissions: newPermissions })\n    ) YIELD node AS module\n\n    RETURN module\n\n";
-export declare const adminModuleQuery = "\n    MATCH (user:User {id: $searchValue})-[:MEMBER_OF]->(role:Role)\n    MATCH (role)-[perm:HAS_PERMISSIONS]->(m:Module)\n    \n    WITH m,\n        coalesce(apoc.convert.fromJsonList(m.permissions), []) AS defaultPermissions,\n        collect(perm) AS perms\n    WITH m, defaultPermissions,\n        apoc.coll.flatten([p IN perms | coalesce(apoc.convert.fromJsonList(p.permissions), [])]) AS rolePerms\n    WITH m,\n        head([x IN defaultPermissions WHERE x.type = 'create' | x.value]) AS defaultCreate,\n        head([x IN defaultPermissions WHERE x.type = 'read'   | x.value]) AS defaultRead,\n        head([x IN defaultPermissions WHERE x.type = 'update' | x.value]) AS defaultUpdate,\n        head([x IN defaultPermissions WHERE x.type = 'delete' | x.value]) AS defaultDelete,\n        rolePerms\n    WITH m,\n        [defaultCreate] + [x IN rolePerms WHERE x.type = 'create' | x.value] AS createValues,\n        [defaultRead]   + [x IN rolePerms WHERE x.type = 'read'   | x.value] AS readValues,\n        [defaultUpdate] + [x IN rolePerms WHERE x.type = 'update' | x.value] AS updateValues,\n        [defaultDelete] + [x IN rolePerms WHERE x.type = 'delete' | x.value] AS deleteValues\n    WITH m,\n        CASE\n        WHEN any(x IN createValues WHERE x = true) THEN true\n        WHEN any(x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(createValues), false)\n        END AS effectiveCreate,\n        CASE\n        WHEN any(x IN readValues WHERE x = true) THEN true\n        WHEN any(x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(readValues), false)\n        END AS effectiveRead,\n        CASE\n        WHEN any(x IN updateValues WHERE x = true) THEN true\n        WHEN any(x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(updateValues), false)\n        END AS effectiveUpdate,\n        CASE\n        WHEN any(x IN deleteValues WHERE x = true) THEN true\n        WHEN any(x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(deleteValues), false)\n        END AS effectiveDelete\n    WITH m, apoc.convert.toJson([\n            { type: \"create\", value: effectiveCreate },\n            { type: \"read\",   value: effectiveRead },\n            { type: \"update\", value: effectiveUpdate },\n            { type: \"delete\", value: effectiveDelete }\n        ]) AS newPermissions\n    CALL apoc.create.vNode(\n    labels(m),\n    apoc.map.merge(properties(m), { permissions: newPermissions })\n    ) YIELD node AS module\n\n    RETURN module\n\n";
+export declare const featureModuleQuery = "\n    OPTIONAL MATCH (user)-[:HAS_MEMBERSHIP]->(fm_ms:Membership)\n    WHERE (fm_ms)-[:IN_COMPANY]->(company) OR NOT (fm_ms)-[:IN_COMPANY]->(:Company)\n    OPTIONAL MATCH (fm_ms)-[:HAS_ROLE]->(role:Role)\n    OPTIONAL MATCH (feature:Feature)\n      WHERE exists((company)-[:HAS_FEATURE]->(feature))\n         OR feature.isCore = true\n    MATCH (m:Module)-[:IN_FEATURE]->(feature)\n    OPTIONAL MATCH (role)-[perm:HAS_PERMISSIONS]->(m)\n    \n    WITH m,\n        coalesce(apoc.convert.fromJsonList(m.permissions), []) AS defaultPermissions,\n        collect(perm) AS perms\n    WITH m, defaultPermissions,\n        apoc.coll.flatten([p IN perms | coalesce(apoc.convert.fromJsonList(p.permissions), [])]) AS rolePerms\n    WITH m,\n        head([x IN defaultPermissions WHERE x.type = 'create' | x.value]) AS defaultCreate,\n        head([x IN defaultPermissions WHERE x.type = 'read'   | x.value]) AS defaultRead,\n        head([x IN defaultPermissions WHERE x.type = 'update' | x.value]) AS defaultUpdate,\n        head([x IN defaultPermissions WHERE x.type = 'delete' | x.value]) AS defaultDelete,\n        rolePerms\n    WITH m,\n        [defaultCreate] + [x IN rolePerms WHERE x.type = 'create' | x.value] AS createValues,\n        [defaultRead]   + [x IN rolePerms WHERE x.type = 'read'   | x.value] AS readValues,\n        [defaultUpdate] + [x IN rolePerms WHERE x.type = 'update' | x.value] AS updateValues,\n        [defaultDelete] + [x IN rolePerms WHERE x.type = 'delete' | x.value] AS deleteValues\n    WITH m,\n        CASE\n        WHEN any(x IN createValues WHERE x = true) THEN true\n        WHEN any(x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(createValues), false)\n        END AS effectiveCreate,\n        CASE\n        WHEN any(x IN readValues WHERE x = true) THEN true\n        WHEN any(x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(readValues), false)\n        END AS effectiveRead,\n        CASE\n        WHEN any(x IN updateValues WHERE x = true) THEN true\n        WHEN any(x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(updateValues), false)\n        END AS effectiveUpdate,\n        CASE\n        WHEN any(x IN deleteValues WHERE x = true) THEN true\n        WHEN any(x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(deleteValues), false)\n        END AS effectiveDelete\n    WITH m, apoc.convert.toJson([\n            { type: \"create\", value: effectiveCreate },\n            { type: \"read\",   value: effectiveRead },\n            { type: \"update\", value: effectiveUpdate },\n            { type: \"delete\", value: effectiveDelete }\n        ]) AS newPermissions\n    CALL apoc.create.vNode(\n    labels(m),\n    apoc.map.merge(properties(m), { permissions: newPermissions })\n    ) YIELD node AS module\n\n    RETURN module\n\n";
+export declare const adminModuleQuery = "\n    MATCH (user:User {id: $searchValue})-[:HAS_MEMBERSHIP]->(am_ms:Membership)\n    WHERE NOT (am_ms)-[:IN_COMPANY]->(:Company)\n    MATCH (am_ms)-[:HAS_ROLE]->(role:Role)\n    MATCH (role)-[perm:HAS_PERMISSIONS]->(m:Module)\n    \n    WITH m,\n        coalesce(apoc.convert.fromJsonList(m.permissions), []) AS defaultPermissions,\n        collect(perm) AS perms\n    WITH m, defaultPermissions,\n        apoc.coll.flatten([p IN perms | coalesce(apoc.convert.fromJsonList(p.permissions), [])]) AS rolePerms\n    WITH m,\n        head([x IN defaultPermissions WHERE x.type = 'create' | x.value]) AS defaultCreate,\n        head([x IN defaultPermissions WHERE x.type = 'read'   | x.value]) AS defaultRead,\n        head([x IN defaultPermissions WHERE x.type = 'update' | x.value]) AS defaultUpdate,\n        head([x IN defaultPermissions WHERE x.type = 'delete' | x.value]) AS defaultDelete,\n        rolePerms\n    WITH m,\n        [defaultCreate] + [x IN rolePerms WHERE x.type = 'create' | x.value] AS createValues,\n        [defaultRead]   + [x IN rolePerms WHERE x.type = 'read'   | x.value] AS readValues,\n        [defaultUpdate] + [x IN rolePerms WHERE x.type = 'update' | x.value] AS updateValues,\n        [defaultDelete] + [x IN rolePerms WHERE x.type = 'delete' | x.value] AS deleteValues\n    WITH m,\n        CASE\n        WHEN any(x IN createValues WHERE x = true) THEN true\n        WHEN any(x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN createValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(createValues), false)\n        END AS effectiveCreate,\n        CASE\n        WHEN any(x IN readValues WHERE x = true) THEN true\n        WHEN any(x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN readValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(readValues), false)\n        END AS effectiveRead,\n        CASE\n        WHEN any(x IN updateValues WHERE x = true) THEN true\n        WHEN any(x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN updateValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(updateValues), false)\n        END AS effectiveUpdate,\n        CASE\n        WHEN any(x IN deleteValues WHERE x = true) THEN true\n        WHEN any(x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true)\n            THEN head([x IN deleteValues WHERE x IS NOT NULL AND x <> false AND x <> true])\n        ELSE coalesce(head(deleteValues), false)\n        END AS effectiveDelete\n    WITH m, apoc.convert.toJson([\n            { type: \"create\", value: effectiveCreate },\n            { type: \"read\",   value: effectiveRead },\n            { type: \"update\", value: effectiveUpdate },\n            { type: \"delete\", value: effectiveDelete }\n        ]) AS newPermissions\n    CALL apoc.create.vNode(\n    labels(m),\n    apoc.map.merge(properties(m), { permissions: newPermissions })\n    ) YIELD node AS module\n\n    RETURN module\n\n";
 //# sourceMappingURL=feature.module.query.d.ts.map

package/dist/foundations/module/queries/feature.module.query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature.module.query.d.ts","sourceRoot":"","sources":["../../../../src/foundations/module/queries/feature.module.query.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,+BAA+B,y0FAsD3C,CAAC;AAGF,eAAO,MAAM,kBAAkB,8mGAQ9B,CAAC;AAGF,eAAO,MAAM,gBAAgB,08FAI5B,CAAC"}
+{"version":3,"file":"feature.module.query.d.ts","sourceRoot":"","sources":["../../../../src/foundations/module/queries/feature.module.query.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,+BAA+B,y0FAsD3C,CAAC;AAMF,eAAO,MAAM,kBAAkB,owGAU9B,CAAC;AAIF,eAAO,MAAM,gBAAgB,mjGAM5B,CAAC"}

package/dist/foundations/module/queries/feature.module.query.js

@@ -59,8 +59,13 @@ exports.modulePermissionResolutionQuery = `
     RETURN module
 `;
 // For regular users: modules via Company → Features → Modules
+// The role read is the membershipRoleMatch expansion bound to the `company` alias the
+// caller already binds (this file exports plain strings, so the helper cannot be used
+// verbatim — see foundations/membership/queries/membership.query.ts).
 exports.featureModuleQuery = `
-    OPTIONAL MATCH (user)-[:MEMBER_OF]->(role:Role)
+    OPTIONAL MATCH (user)-[:HAS_MEMBERSHIP]->(fm_ms:Membership)
+    WHERE (fm_ms)-[:IN_COMPANY]->(company) OR NOT (fm_ms)-[:IN_COMPANY]->(:Company)
+    OPTIONAL MATCH (fm_ms)-[:HAS_ROLE]->(role:Role)
     OPTIONAL MATCH (feature:Feature)
       WHERE exists((company)-[:HAS_FEATURE]->(feature))
          OR feature.isCore = true
@@ -68,9 +73,12 @@ exports.featureModuleQuery = `
     OPTIONAL MATCH (role)-[perm:HAS_PERMISSIONS]->(m)
     ${exports.modulePermissionResolutionQuery}
 `;
-// For Administrator users: modules via Role → HAS_PERMISSIONS → Module
+// For Administrator users: modules via the PLATFORM membership (no IN_COMPANY edge)
+// → Role → HAS_PERMISSIONS → Module
 exports.adminModuleQuery = `
-    MATCH (user:User {id: $searchValue})-[:MEMBER_OF]->(role:Role)
+    MATCH (user:User {id: $searchValue})-[:HAS_MEMBERSHIP]->(am_ms:Membership)
+    WHERE NOT (am_ms)-[:IN_COMPANY]->(:Company)
+    MATCH (am_ms)-[:HAS_ROLE]->(role:Role)
     MATCH (role)-[perm:HAS_PERMISSIONS]->(m:Module)
     ${exports.modulePermissionResolutionQuery}
 `;

package/dist/foundations/module/queries/feature.module.query.js.map

@@ -1 +1 @@
-{"version":3,"file":"feature.module.query.js","sourceRoot":"","sources":["../../../../src/foundations/module/queries/feature.module.query.ts"],"names":[],"mappings":";;;AAAA,mFAAmF;AACnF,wEAAwE;AAC3D,QAAA,+BAA+B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsD9C,CAAC;AAEF,8DAA8D;AACjD,QAAA,kBAAkB,GAAG;;;;;;;MAO5B,uCAA+B;CACpC,CAAC;AAEF,uEAAuE;AAC1D,QAAA,gBAAgB,GAAG;;;MAG1B,uCAA+B;CACpC,CAAC"}
+{"version":3,"file":"feature.module.query.js","sourceRoot":"","sources":["../../../../src/foundations/module/queries/feature.module.query.ts"],"names":[],"mappings":";;;AAAA,mFAAmF;AACnF,wEAAwE;AAC3D,QAAA,+BAA+B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsD9C,CAAC;AAEF,8DAA8D;AAC9D,sFAAsF;AACtF,sFAAsF;AACtF,sEAAsE;AACzD,QAAA,kBAAkB,GAAG;;;;;;;;;MAS5B,uCAA+B;CACpC,CAAC;AAEF,oFAAoF;AACpF,oCAAoC;AACvB,QAAA,gBAAgB,GAAG;;;;;MAK1B,uCAA+B;CACpC,CAAC"}

package/dist/foundations/role/repositories/role.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/role/repositories/role.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2DAA2D,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAkB,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAEhE,qBACa,cAAe,YAAW,YAAY;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,YAAY;IAE1C,YAAY;IAMZ,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxE,UAAU,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAenD,QAAQ,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAenD,IAAI,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAuBhF,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA0BvG,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA2BzG,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBjF,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjF,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAaxD"}
+{"version":3,"file":"role.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/role/repositories/role.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2DAA2D,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAkB,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAEhE,qBACa,cAAe,YAAW,YAAY;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,YAAY;IAE1C,YAAY;IAMZ,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxE,UAAU,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAenD,QAAQ,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAenD,IAAI,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAuBhF,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA+BvG,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAiCzG,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBjF,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjF,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAaxD"}

package/dist/foundations/role/repositories/role.repository.js

@@ -87,11 +87,16 @@ let RoleRepository = class RoleRepository {
         };
         query.query += `
       MATCH (user:User {id: $userId})-[:BELONGS_TO]->(company)
-      MATCH (user)-[:MEMBER_OF]->(role:Role)
+      // Required (MATCH) variant of membershipRoleMatch bound to the company alias
+      // already matched above — see membership.query.ts. Company roles + platform roles.
+      MATCH (user)-[:HAS_MEMBERSHIP]->(role_ms:Membership)
+      WHERE (role_ms)-[:IN_COMPANY]->(company)
+         OR NOT (role_ms)-[:IN_COMPANY]->(:Company)
+      MATCH (role_ms)-[:HAS_ROLE]->(role:Role)
       WHERE role.id <> $administratorsId
       ${params.term ? "AND toLower(role.name) CONTAINS toLower($term)" : ""}
-      
-      WITH role
+
+      WITH DISTINCT role
       ORDER BY role.name ASC
       {CURSOR}
       
@@ -110,7 +115,13 @@ let RoleRepository = class RoleRepository {
         query.query += `
       MATCH (user:User {id: $userId})-[:BELONGS_TO]->(company)
       MATCH (role:Role)
-      WHERE NOT (role)<-[:MEMBER_OF]-(user)
+      // Negated membership read (see membership.query.ts): the role must not be held
+      // through the company membership NOR through the platform membership.
+      WHERE NOT EXISTS {
+        MATCH (user)-[:HAS_MEMBERSHIP]->(nu_ms:Membership)-[:HAS_ROLE]->(role)
+        WHERE (nu_ms)-[:IN_COMPANY]->(company)
+           OR NOT (nu_ms)-[:IN_COMPANY]->(:Company)
+      }
       ${params.term ? "AND toLower(role.name) CONTAINS toLower($term)" : ""}
       AND role.id <> $administratorsId
       

package/dist/foundations/role/repositories/role.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"role.repository.js","sourceRoot":"","sources":["../../../../src/foundations/role/repositories/role.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,yEAAgE;AAChE,2CAA0D;AAE1D,8EAA0E;AAC1E,mDAAgE;AAGzD,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;IAAG,CAAC;IAEpD,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxB,KAAK,EAAE,mFAAmF;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAwC;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzE,KAAK,CAAC,WAAW,GAAG;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;;KAIb,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzE,KAAK,CAAC,WAAW,GAAG;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;KAGb,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAA0B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzE,KAAK,CAAC,WAAW,GAAG;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;KAGb,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAyD;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAEhG,KAAK,CAAC,WAAW,GAAG;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,qBAAM,CAAC,aAAa;SACvC,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;QAGV,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,EAAE;;;;;;;KAOtE,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAyE;QACzF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAEhG,KAAK,CAAC,WAAW,GAAG;YAClB,GAAG,KAAK,CAAC,WAAW;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,qBAAM,CAAC,aAAa;SACvC,CAAC;QAEF,KAAK,CAAC,KAAK,IAAI;;;;QAIX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,EAAE;;;;;;;KAOtE,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAyE;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhH,KAAK,CAAC,WAAW,GAAG;YAClB,GAAG,KAAK,CAAC,WAAW;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,qBAAM,CAAC,aAAa;SACvC,CAAC;QAEF,KAAK,CAAC,KAAK,IAAI;;;;QAIX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,EAAE;;;;;;;;KAQtE,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0D;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAErC,KAAK,CAAC,WAAW,GAAG;YAClB,GAAG,KAAK,CAAC,WAAW;YACpB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;;;;;KAOb,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0D;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAErC,KAAK,CAAC,WAAW,GAAG;YAClB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;;;KAKb,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAErC,KAAK,CAAC,WAAW,GAAG;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;KAGb,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;CACF,CAAA;AA1LY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;qCAEyB,4BAAY;GADrC,cAAc,CA0L1B"}
+{"version":3,"file":"role.repository.js","sourceRoot":"","sources":["../../../../src/foundations/role/repositories/role.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,yEAAgE;AAChE,2CAA0D;AAE1D,8EAA0E;AAC1E,mDAAgE;AAGzD,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;IAAG,CAAC;IAEpD,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxB,KAAK,EAAE,mFAAmF;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAwC;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzE,KAAK,CAAC,WAAW,GAAG;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;;KAIb,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzE,KAAK,CAAC,WAAW,GAAG;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;KAGb,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAA0B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzE,KAAK,CAAC,WAAW,GAAG;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;KAGb,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAyD;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAEhG,KAAK,CAAC,WAAW,GAAG;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,qBAAM,CAAC,aAAa;SACvC,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;QAGV,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,EAAE;;;;;;;KAOtE,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAyE;QACzF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAEhG,KAAK,CAAC,WAAW,GAAG;YAClB,GAAG,KAAK,CAAC,WAAW;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,qBAAM,CAAC,aAAa;SACvC,CAAC;QAEF,KAAK,CAAC,KAAK,IAAI;;;;;;;;;QASX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,EAAE;;;;;;;KAOtE,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAyE;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,qBAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhH,KAAK,CAAC,WAAW,GAAG;YAClB,GAAG,KAAK,CAAC,WAAW;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,qBAAM,CAAC,aAAa;SACvC,CAAC;QAEF,KAAK,CAAC,KAAK,IAAI;;;;;;;;;;QAUX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,EAAE;;;;;;;;KAQtE,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0D;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAErC,KAAK,CAAC,WAAW,GAAG;YAClB,GAAG,KAAK,CAAC,WAAW;YACpB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;;;;;KAOb,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0D;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAErC,KAAK,CAAC,WAAW,GAAG;YAClB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;;;KAKb,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAErC,KAAK,CAAC,WAAW,GAAG;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,GAAG;;;KAGb,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;CACF,CAAA;AArMY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;qCAEyB,4BAAY;GADrC,cAAc,CAqM1B"}

package/dist/foundations/user/entities/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/foundations/user/entities/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAmC,MAAM,iBAAiB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qCAAqC,CAAC;AAElE,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAKhD;;GAEG;AACH,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,IAAI,CAAC;IAE1B,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;EA8DzB,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,OAAO,cAAc,CAAC;AAGvD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;EAA+C,CAAC;AAC5E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAAkD,CAAC;AAClF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;EAAgD,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/foundations/user/entities/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAmC,MAAM,iBAAiB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qCAAqC,CAAC;AAElE,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAKhD;;GAEG;AACH,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,IAAI,CAAC;IAE1B,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;EAmEzB,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,OAAO,cAAc,CAAC;AAGvD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;EAA+C,CAAC;AAC5E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAAkD,CAAC;AAClF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;EAAgD,CAAC"}

package/dist/foundations/user/entities/user.js

@@ -52,10 +52,15 @@ exports.UserDescriptor = (0, common_1.defineEntity)()({
     },
     // Relationship definitions
     relationships: {
+        // Serialisation-only: roles are hydrated through the Membership path
+        // (see foundations/membership/queries/membership.query.ts) — no single-hop
+        // (user)-[:HAS_MEMBERSHIP]->(role) edge exists. The serialiser maps by key +
+        // model, and no generic descriptor-driven writer touches this relationship
+        // (UserRepository/UserService do not extend AbstractRepository/AbstractService).
         role: {
             model: role_meta_1.roleMeta,
             direction: "out",
-            relationship: "MEMBER_OF",
+            relationship: "HAS_MEMBERSHIP",
             cardinality: "many",
             dtoKey: "roles",
         },

package/dist/foundations/user/entities/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../src/foundations/user/entities/user.ts"],"names":[],"mappings":";;;AAAA,4CAA0E;AAE1E,4DAAmE;AAEnE,mEAA+D;AAE/D,6DAAyD;AACzD,iCAAqC;AACrC,2CAA4E;AA4B5E;;;;;GAKG;AACU,QAAA,cAAc,GAAG,IAAA,qBAAY,GAAQ,CAAC;IACjD,GAAG,oBAAQ;IAEX,cAAc,EAAE,CAAC,cAAS,CAAC;IAE3B,oBAAoB;IACpB,MAAM,EAAE;QACN,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE;QACtD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBAClC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,OAAO,SAAS,CAAC;gBACnC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjE,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;QACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;QAC3C,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;QAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAC9D,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAC/D,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAC/D,kBAAkB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE;KACnE;IAED,mDAAmD;IACnD,aAAa,EAAE;QACb,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;SACxC;KACF;IAED,2BAA2B;IAC3B,aAAa,EAAE;QACb,IAAI,EAAE;YACJ,KAAK,EAAE,oBAAQ;YACf,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,WAAW;YACzB,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,OAAO;SAChB;QACD,OAAO,EAAE;YACP,KAAK,EAAE,2BAAiB,CAAC,KAAK;YAC9B,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,YAAY;YAC1B,WAAW,EAAE,KAAK;SACnB;QACD,MAAM,EAAE;YACN,KAAK,EAAE,wBAAU;YACjB,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,YAAY;YAC1B,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,SAAS;SAClB;KACF;CACF,CAAC,CAAC;AAKH,+CAA+C;AAClC,QAAA,eAAe,GAAG,IAAA,0BAAiB,EAAC,sBAAc,EAAE,qBAAS,CAAC,CAAC;AAC/D,QAAA,kBAAkB,GAAG,IAAA,0BAAiB,EAAC,sBAAc,EAAE,wBAAY,CAAC,CAAC;AACrE,QAAA,gBAAgB,GAAG,IAAA,0BAAiB,EAAC,sBAAc,EAAE,sBAAU,CAAC,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../src/foundations/user/entities/user.ts"],"names":[],"mappings":";;;AAAA,4CAA0E;AAE1E,4DAAmE;AAEnE,mEAA+D;AAE/D,6DAAyD;AACzD,iCAAqC;AACrC,2CAA4E;AA4B5E;;;;;GAKG;AACU,QAAA,cAAc,GAAG,IAAA,qBAAY,GAAQ,CAAC;IACjD,GAAG,oBAAQ;IAEX,cAAc,EAAE,CAAC,cAAS,CAAC;IAE3B,oBAAoB;IACpB,MAAM,EAAE;QACN,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE;QACtD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBAClC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,OAAO,SAAS,CAAC;gBACnC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjE,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;QACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;QAC3C,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;QAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAC9D,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAC/D,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAC/D,kBAAkB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE;KACnE;IAED,mDAAmD;IACnD,aAAa,EAAE;QACb,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;SACxC;KACF;IAED,2BAA2B;IAC3B,aAAa,EAAE;QACb,qEAAqE;QACrE,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,iFAAiF;QACjF,IAAI,EAAE;YACJ,KAAK,EAAE,oBAAQ;YACf,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,gBAAgB;YAC9B,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,OAAO;SAChB;QACD,OAAO,EAAE;YACP,KAAK,EAAE,2BAAiB,CAAC,KAAK;YAC9B,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,YAAY;YAC1B,WAAW,EAAE,KAAK;SACnB;QACD,MAAM,EAAE;YACN,KAAK,EAAE,wBAAU;YACjB,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,YAAY;YAC1B,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,SAAS;SAClB;KACF;CACF,CAAC,CAAC;AAKH,+CAA+C;AAClC,QAAA,eAAe,GAAG,IAAA,0BAAiB,EAAC,sBAAc,EAAE,qBAAS,CAAC,CAAC;AAC/D,QAAA,kBAAkB,GAAG,IAAA,0BAAiB,EAAC,sBAAc,EAAE,wBAAY,CAAC,CAAC;AACrE,QAAA,gBAAgB,GAAG,IAAA,0BAAiB,EAAC,sBAAc,EAAE,sBAAU,CAAC,CAAC"}

package/dist/foundations/user/repositories/user.repository.d.ts

@@ -12,6 +12,7 @@ export declare class UserRepository implements OnModuleInit {
     onModuleInit(): Promise<void>;
     makeCompanyAdmin(params: {
         userId: string;
+        companyId: string;
     }): Promise<void>;
     findOneForAdmin(params: {
         userId: string;

package/dist/foundations/user/repositories/user.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/user/repositories/user.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2DAA2D,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAM1E,OAAO,EAAE,IAAI,EAAkB,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAE5E,qBACa,cAAe,YAAW,YAAY;IAE/C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,UAAU,EACf,iBAAiB,EAAE,iBAAiB;IAGjD,YAAY;IAkBZ,gBAAgB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;IAiB3C,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBhE;;;;OAIG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BhE,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsDvD,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B3E,WAAW,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B/E,UAAU,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBnD,QAAQ,CAAC,MAAM,EAAE;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,MAAM,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAkCb,oBAAoB,CAAC,MAAM,EAAE;QACjC,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAuBb,iBAAiB,CAAC,MAAM,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAoBb,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA0BtG,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA2BzG,MAAM,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DX,SAAS,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpD,GAAG,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,CAAC;IAyDX,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxE,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBrD,SAAS,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBlE,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBtE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjD,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxE,kBAAkB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBnF;;;OAGG;IACG,0BAA0B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAenD;;;OAGG;IACG,mCAAmC,CAAC,MAAM,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAoBhG;;;OAGG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAkB5E"}
+{"version":3,"file":"user.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/user/repositories/user.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2DAA2D,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAY1E,OAAO,EAAE,IAAI,EAAkB,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAE5E,qBACa,cAAe,YAAW,YAAY;IAE/C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,UAAU,EACf,iBAAiB,EAAE,iBAAiB;IAGjD,YAAY;IAkBZ,gBAAgB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAmB9D,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBhE;;;;OAIG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BhE,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsDvD,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B3E,WAAW,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC/E,UAAU,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBnD,QAAQ,CAAC,MAAM,EAAE;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,MAAM,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAkCb,oBAAoB,CAAC,MAAM,EAAE;QACjC,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAuBb,iBAAiB,CAAC,MAAM,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAoBb,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA0BtG,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA+BzG,MAAM,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAyDX,SAAS,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpD,GAAG,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,CAAC;IAyDX,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxE,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBrD,SAAS,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBlE,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBtE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjD,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BxE,kBAAkB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBnF;;;OAGG;IACG,0BAA0B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAiBnD;;;OAGG;IACG,mCAAmC,CAAC,MAAM,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA0BhG;;;OAGG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAmB5E"}

package/dist/foundations/user/repositories/user.repository.js

@@ -17,6 +17,7 @@ const system_roles_1 = require("../../../common/constants/system.roles");
 const neo4j_service_1 = require("../../../core/neo4j/services/neo4j.service");
 const company_meta_1 = require("../../company/entities/company.meta");
 const feature_meta_1 = require("../../feature/entities/feature.meta");
+const membership_query_1 = require("../../membership/queries/membership.query");
 const module_model_1 = require("../../module/entities/module.model");
 const feature_module_query_1 = require("../../module/queries/feature.module.query");
 const role_meta_1 = require("../../role/entities/role.meta");
@@ -48,12 +49,14 @@ let UserRepository = class UserRepository {
         const query = this.neo4j.initQuery();
         query.queryParams = {
             userId: params.userId,
-            roleId: system_roles_1.RoleId.CompanyAdministrator,
+            companyId: params.companyId,
+            membershipId: (0, crypto_1.randomUUID)(),
+            roleIds: [system_roles_1.RoleId.CompanyAdministrator],
         };
         query.query = `
-      MATCH (role:Role {id: $roleId})
+      MATCH (company:Company {id: $companyId})
       MATCH (user:User {id: $userId})
-      MERGE (user)-[:MEMBER_OF]->(role)
+      ${(0, membership_query_1.grantCompanyRoles)({ userAlias: "user", companyAlias: "company" })}
     `;
         await this.neo4j.writeOne(query);
     }
@@ -65,8 +68,13 @@ let UserRepository = class UserRepository {
         query.query = `
       MATCH (user:User {id: $userId})
 
-      OPTIONAL MATCH (user)-[:MEMBER_OF]->(user_role:Role)
       OPTIONAL MATCH (user)-[:BELONGS_TO]->(user_company:Company)
+      // membershipRoleMatch bound to the matched company alias: this query has no
+      // $companyId param (it is not CLS-scoped). See membership.query.ts.
+      OPTIONAL MATCH (user)-[:HAS_MEMBERSHIP]->(user_role_ms:Membership)
+      WHERE (user_role_ms)-[:IN_COMPANY]->(user_company)
+         OR NOT (user_role_ms)-[:IN_COMPANY]->(:Company)
+      OPTIONAL MATCH (user_role_ms)-[:HAS_ROLE]->(user_role:Role)
       RETURN user, user_role, user_company
     `;
         return this.neo4j.readOne(query);
@@ -84,8 +92,13 @@ let UserRepository = class UserRepository {
         query.query = `
       MATCH (${user_meta_1.userMeta.nodeName}:User {id: $userId})
 
-      OPTIONAL MATCH (${user_meta_1.userMeta.nodeName})-[:MEMBER_OF]->(${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}:${role_meta_1.roleMeta.labelName})
       OPTIONAL MATCH (${user_meta_1.userMeta.nodeName})-[:BELONGS_TO]->(${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName}:${company_meta_1.companyMeta.labelName})
+      // membershipRoleMatch bound to the matched company alias: this query deliberately
+      // does not depend on CLS/$companyId. See membership.query.ts.
+      OPTIONAL MATCH (${user_meta_1.userMeta.nodeName})-[:HAS_MEMBERSHIP]->(${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}_ms:Membership)
+      WHERE (${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}_ms)-[:IN_COMPANY]->(${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName})
+         OR NOT (${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}_ms)-[:IN_COMPANY]->(:${company_meta_1.companyMeta.labelName})
+      OPTIONAL MATCH (${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}_ms)-[:HAS_ROLE]->(${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}:${role_meta_1.roleMeta.labelName})
 
       OPTIONAL MATCH (${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName}_${feature_meta_1.featureMeta.nodeName}:${feature_meta_1.featureMeta.labelName})
       WHERE ${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName}_${feature_meta_1.featureMeta.nodeName}.isCore = true
@@ -107,7 +120,7 @@ let UserRepository = class UserRepository {
         query.query += `
       ${this.userCypherService.default({ searchField: "id" })}
 
-      OPTIONAL MATCH (user)-[:MEMBER_OF]->(user_role:Role)
+      ${(0, membership_query_1.membershipRoleMatch)({ userAlias: "user", roleAlias: "user_role" })}
       OPTIONAL MATCH (user)-[:BELONGS_TO]->(user_company:Company)
       OPTIONAL MATCH (user_company)-[:HAS_CONFIGURATION]->(user_company_configuration:Configuration)
       MATCH (${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName}_${feature_meta_1.featureMeta.nodeName}:${feature_meta_1.featureMeta.labelName})
@@ -155,7 +168,7 @@ let UserRepository = class UserRepository {
         query.query = `
       MATCH (company:Company {id: $companyId})
       MATCH (user:User {id: $userId})-[:BELONGS_TO]->(company)
-      OPTIONAL MATCH (user)-[:MEMBER_OF]->(user_role:Role) 
+      ${(0, membership_query_1.membershipRoleMatch)({ userAlias: "user", roleAlias: "user_role" })}
       OPTIONAL MATCH (user)-[:BELONGS_TO]->(user_company:Company)
 
       MATCH (${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName}_${feature_meta_1.featureMeta.nodeName}:${feature_meta_1.featureMeta.labelName})
@@ -176,8 +189,13 @@ let UserRepository = class UserRepository {
       WHERE toLower(${user_meta_1.userMeta.nodeName}.email) = $email
       ${params.includeDeleted ? `` : `AND ${user_meta_1.userMeta.nodeName}.isDeleted = false`}
       
-      OPTIONAL MATCH (${user_meta_1.userMeta.nodeName})-[:MEMBER_OF]->(${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}:${role_meta_1.roleMeta.labelName}) 
       OPTIONAL MATCH (${user_meta_1.userMeta.nodeName})-[:BELONGS_TO]->(${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName}:${company_meta_1.companyMeta.labelName})
+      // membershipRoleMatch bound to the matched company alias: the login/lookup path
+      // has no $companyId param. See membership.query.ts.
+      OPTIONAL MATCH (${user_meta_1.userMeta.nodeName})-[:HAS_MEMBERSHIP]->(${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}_ms:Membership)
+      WHERE (${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}_ms)-[:IN_COMPANY]->(${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName})
+         OR NOT (${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}_ms)-[:IN_COMPANY]->(:${company_meta_1.companyMeta.labelName})
+      OPTIONAL MATCH (${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}_ms)-[:HAS_ROLE]->(${user_meta_1.userMeta.nodeName}_${role_meta_1.roleMeta.nodeName}:${role_meta_1.roleMeta.labelName})
 
       MATCH (${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName}_${feature_meta_1.featureMeta.nodeName}:${feature_meta_1.featureMeta.labelName})
       WHERE ${user_meta_1.userMeta.nodeName}_${company_meta_1.companyMeta.nodeName}_${feature_meta_1.featureMeta.nodeName}.isCore = true 
@@ -195,10 +213,15 @@ let UserRepository = class UserRepository {
             code: params.code,
         };
         query.query = `
-      MATCH (user:User {code: $code, isDeleted: false}) 
-      
-      OPTIONAL MATCH (user)-[:MEMBER_OF]->(user_role:Role) 
+      MATCH (user:User {code: $code, isDeleted: false})
+
       OPTIONAL MATCH (user)-[:BELONGS_TO]->(user_company:Company)
+      // membershipRoleMatch bound to the matched company alias: the activation-code
+      // lookup has no $companyId param. See membership.query.ts.
+      OPTIONAL MATCH (user)-[:HAS_MEMBERSHIP]->(user_role_ms:Membership)
+      WHERE (user_role_ms)-[:IN_COMPANY]->(user_company)
+         OR NOT (user_role_ms)-[:IN_COMPANY]->(:Company)
+      OPTIONAL MATCH (user_role_ms)-[:HAS_ROLE]->(user_role:Role)
       RETURN user, user_role, user_company
     `;
         return this.neo4j.readOne(query);
@@ -228,7 +251,7 @@ let UserRepository = class UserRepository {
         query.query += `
       {CURSOR}
 
-      OPTIONAL MATCH (${user_meta_1.userMeta.nodeName})-[:MEMBER_OF]->(${user_meta_1.userMeta.nodeName}_role:Role)
+      ${(0, membership_query_1.membershipRoleMatch)({ userAlias: user_meta_1.userMeta.nodeName, roleAlias: `${user_meta_1.userMeta.nodeName}_role` })}
       RETURN ${user_meta_1.userMeta.nodeName}, ${user_meta_1.userMeta.nodeName}_role
     `;
         return this.neo4j.readMany(query);
@@ -263,7 +286,7 @@ let UserRepository = class UserRepository {
       MATCH (company:Company {id: $companyId})<-[:BELONGS_TO]-(user:User)
       ${params.isDeleted ? `WHERE user.isDeleted = $isDeleted` : ``}
       ${params.term ? `${params.isDeleted ? `AND` : `WHERE`} toLower(user.name) CONTAINS toLower($term)` : ``}
-      OPTIONAL MATCH (user)-[:MEMBER_OF]->(user_role:Role)
+      ${(0, membership_query_1.membershipRoleMatch)({ userAlias: "user", roleAlias: "user_role" })}
       RETURN user, user_role
     `;
         return this.neo4j.readMany(query);
@@ -278,13 +301,13 @@ let UserRepository = class UserRepository {
         query.query += `
       MATCH (user:User {isDeleted: false})-[:BELONGS_TO]->(company)
       ${params.term ? "WHERE toLower(user.name) CONTAINS toLower($term)" : ""}
-      MATCH (user)-[:MEMBER_OF]->(role:Role {id: $roleId})
-      
-      WITH user
+      ${(0, membership_query_1.membershipRoleMatchRequired)({ userAlias: "user", roleAlias: "role" })}
+
+      WITH DISTINCT user
       ORDER BY user.name ASC
       {CURSOR}
-      
-      OPTIONAL MATCH (user)-[:MEMBER_OF]->(user_role:Role) 
+
+      ${(0, membership_query_1.membershipRoleMatch)({ userAlias: "user", roleAlias: "user_role" })}
       OPTIONAL MATCH (user)-[:BELONGS_TO]->(user_company:Company)
       RETURN user, user_role, user_company
     `;
@@ -300,14 +323,18 @@ let UserRepository = class UserRepository {
         query.query += `
       MATCH (referenceRole:Role {id: $roleId})
       MATCH (user:User {isDeleted: false})-[:BELONGS_TO]->(company)
-      WHERE NOT (user)-[:MEMBER_OF]->(referenceRole)
-      ${params.term ? "WHERE toLower(user.name) CONTAINS toLower($term)" : ""}
-      
-      WITH user
+      WHERE NOT EXISTS {
+        MATCH (user)-[:HAS_MEMBERSHIP]->(nr_ms:Membership)-[:HAS_ROLE]->(referenceRole)
+        WHERE (nr_ms)-[:IN_COMPANY]->(:Company {id: $companyId})
+           OR NOT (nr_ms)-[:IN_COMPANY]->(:Company)
+      }
+      ${params.term ? "AND toLower(user.name) CONTAINS toLower($term)" : ""}
+
+      WITH DISTINCT user
       ORDER BY user.name ASC
       {CURSOR}
-      
-      OPTIONAL MATCH (user)-[:MEMBER_OF]->(user_role:Role) 
+
+      ${(0, membership_query_1.membershipRoleMatch)({ userAlias: "user", roleAlias: "user_role" })}
       OPTIONAL MATCH (user)-[:BELONGS_TO]->(user_company:Company)
       RETURN user, user_role, user_company
     `;
@@ -329,7 +356,8 @@ let UserRepository = class UserRepository {
             code: (0, crypto_1.randomUUID)(),
             codeExpiration: new Date(new Date().getTime() + 7 * 24 * 60 * 60 * 1000).toISOString(),
             companyId: params.companyId,
-            roleIds: params.roleIds,
+            roleIds: params.roleIds ?? [],
+            membershipId: (0, crypto_1.randomUUID)(),
             termsAcceptedAt: params.termsAcceptedAt ?? null,
             marketingConsent: params.marketingConsent ?? false,
             marketingConsentAt: params.marketingConsentAt ?? null,
@@ -355,14 +383,11 @@ let UserRepository = class UserRepository {
         createdAt: datetime(),
         updatedAt: datetime()
       })-[:BELONGS_TO]->(company)
-      ${params.roleIds && params.roleIds.length > 0
-            ? `
-            WITH user, company
-            UNWIND $roleIds AS roleId
-            MATCH (role:Role {id: roleId})
-            CREATE (user)-[:MEMBER_OF]->(role)
-          `
-            : ""}
+
+      // Always create the (user, company) Membership — the BELONGS_TO ⇄ Membership
+      // invariant holds even when the user starts with no roles.
+      WITH user, company
+      ${(0, membership_query_1.grantCompanyRoles)({ userAlias: "user", companyAlias: "company" })}
     `;
         await this.neo4j.writeOne(query);
         return this.findByUserId({ userId: params.userId, companyId: params.companyId });
@@ -408,7 +433,8 @@ let UserRepository = class UserRepository {
             bio: params.bio ?? null,
             password: params.password,
             avatar: params.avatar ?? null,
-            roleIds: params.roles,
+            roleIds: params.roles ?? [],
+            membershipId: (0, crypto_1.randomUUID)(),
             isActive: params.isActive,
             phone: params.phone ?? null,
         };
@@ -419,17 +445,16 @@ let UserRepository = class UserRepository {
 
       ${params.isAdmin && params.roles !== undefined
             ? `
-            // Delete outdated MEMBER_OF relationships
-            WITH user
-            OPTIONAL MATCH (user)-[roleRel:MEMBER_OF]->(role:Role)
-            WHERE NOT role.id IN $roleIds
-            DELETE roleRel
+            // Drop the roles this user no longer holds IN THIS COMPANY.
+            // Platform memberships (no IN_COMPANY edge) are untouched here.
+            WITH user, company
+            OPTIONAL MATCH (user)-[:HAS_MEMBERSHIP]->(put_ms:Membership)-[:IN_COMPANY]->(company)
+            OPTIONAL MATCH (put_ms)-[stale:HAS_ROLE]->(stale_role:Role)
+            WHERE NOT stale_role.id IN $roleIds
+            DELETE stale
 
-            // Add new MEMBER_OF relationships
-            WITH user, $roleIds AS roleIds
-            UNWIND roleIds AS roleId
-            MATCH (role:Role {id: roleId})
-            MERGE (user)-[:MEMBER_OF]->(role)
+            WITH DISTINCT user, company
+            ${(0, membership_query_1.grantCompanyRoles)({ userAlias: "user", companyAlias: "company" })}
           `
             : ``}
     `;
@@ -507,12 +532,23 @@ let UserRepository = class UserRepository {
             ...query.queryParams,
             roleId: params.roleId,
             userId: params.userId,
+            membershipId: (0, crypto_1.randomUUID)(),
+            roleIds: [params.roleId],
         };
-        query.query += `
-      MATCH (user:User {id: $userId})-[:BELONGS_TO]->(company)
-      MATCH (role:Role {id: $roleId})
-      CREATE (user)-[:MEMBER_OF]->(role)
-    `;
+        // Administrator is a PLATFORM role: it lives on the membership with no IN_COMPANY
+        // edge. Every other role is granted on the CLS company's membership.
+        if (params.roleId === system_roles_1.RoleId.Administrator) {
+            query.query += `
+        MATCH (user:User {id: $userId})
+        ${(0, membership_query_1.grantPlatformRole)({ userAlias: "user" })}
+      `;
+        }
+        else {
+            query.query += `
+        MATCH (user:User {id: $userId})-[:BELONGS_TO]->(company)
+        ${(0, membership_query_1.grantCompanyRoles)({ userAlias: "user", companyAlias: "company" })}
+      `;
+        }
         await this.neo4j.writeOne(query);
     }
     async removeUserFromRole(params) {
@@ -521,11 +557,13 @@ let UserRepository = class UserRepository {
             ...query.queryParams,
             roleId: params.roleId,
             userId: params.userId,
+            administratorRoleId: system_roles_1.RoleId.Administrator,
         };
         query.query += `
-      MATCH (user:User {id: $userId})-[:BELONGS_TO]->(company)
-      MATCH (role:Role {id: $roleId})
-      MATCH (user)-[rel:MEMBER_OF]->(role)
+      MATCH (user:User {id: $userId})-[:HAS_MEMBERSHIP]->(rm_ms:Membership)
+      WHERE (rm_ms)-[:IN_COMPANY]->(:Company {id: $companyId})
+         OR ($roleId = $administratorRoleId AND NOT (rm_ms)-[:IN_COMPANY]->(:Company))
+      MATCH (rm_ms)-[rel:HAS_ROLE]->(:Role {id: $roleId})
       DELETE rel
     `;
         await this.neo4j.writeOne(query);
@@ -540,8 +578,10 @@ let UserRepository = class UserRepository {
             administratorRoleId: system_roles_1.RoleId.Administrator,
         };
         query.query = `
-      MATCH (user:User {isDeleted: false})-[:MEMBER_OF]->(role:Role {id: $administratorRoleId})
-      RETURN user
+      MATCH (user:User {isDeleted: false})-[:HAS_MEMBERSHIP]->(pa_ms:Membership)
+      WHERE NOT (pa_ms)-[:IN_COMPANY]->(:Company)
+      MATCH (pa_ms)-[:HAS_ROLE]->(:Role {id: $administratorRoleId})
+      RETURN DISTINCT user
     `;
         return this.neo4j.readMany(query);
     }
@@ -559,8 +599,14 @@ let UserRepository = class UserRepository {
       MATCH (stripeCustomer:StripeCustomer {stripeCustomerId: $stripeCustomerId})
       MATCH (company:Company)<-[:BELONGS_TO]-(stripeCustomer)
       MATCH (user:User {isDeleted: false})-[:BELONGS_TO]->(company)
-      MATCH (user)-[:MEMBER_OF]->(role:Role {id: $companyAdminRoleId})
-      OPTIONAL MATCH (user)-[:MEMBER_OF]->(user_role:Role)
+      MATCH (user)-[:HAS_MEMBERSHIP]->(ca_ms:Membership)-[:IN_COMPANY]->(company)
+      MATCH (ca_ms)-[:HAS_ROLE]->(:Role {id: $companyAdminRoleId})
+      // membershipRoleMatch bound to the matched company alias: this query has no
+      // $companyId param. See membership.query.ts.
+      OPTIONAL MATCH (user)-[:HAS_MEMBERSHIP]->(user_role_ms:Membership)
+      WHERE (user_role_ms)-[:IN_COMPANY]->(company)
+         OR NOT (user_role_ms)-[:IN_COMPANY]->(:Company)
+      OPTIONAL MATCH (user_role_ms)-[:HAS_ROLE]->(user_role:Role)
       RETURN user, user_role
     `;
         return this.neo4j.readMany(query);
@@ -578,8 +624,9 @@ let UserRepository = class UserRepository {
         query.query = `
       MATCH (company:Company {id: $companyId})
       MATCH (user:User {isDeleted: false})-[:BELONGS_TO]->(company)
-      MATCH (user)-[:MEMBER_OF]->(role:Role {id: $companyAdminRoleId})
-      OPTIONAL MATCH (user)-[:MEMBER_OF]->(user_role:Role)
+      MATCH (user)-[:HAS_MEMBERSHIP]->(ca_ms:Membership)-[:IN_COMPANY]->(company)
+      MATCH (ca_ms)-[:HAS_ROLE]->(:Role {id: $companyAdminRoleId})
+      ${(0, membership_query_1.membershipRoleMatch)({ userAlias: "user", roleAlias: "user_role" })}
       RETURN user, user_role
     `;
         return this.neo4j.readMany(query);